Systems and Methods Providing Connection Lease Anti-Theft Features for Virtual Computing Sessions

1. A computing device comprising: a memory and a processor cooperating with the memory and configured to receive a connection request from a client device having a public/private encryption key pair associated therewith, the connection request based upon a connection lease and the public key for the client device, and the connection lease including an authenticated version of the public key for the client device so that the connection lease is specific to the client device; verify that the authenticated version of the public key upon which the connection lease was generated matches the public key for the client device; and authorize the connection with the client device and provide the client device with access to a virtual computing session via the connection.

2. The computing device of claim 1 wherein the processor is further configured to, prior to authorizing the connection with the client device: initiate a challenge to be signed by the client device with the private key associated with the client device; and validate the signed response with the public key for the client device.

3. The computing device of claim 2 wherein the processor initiates the challenge and validates the signed response prior to verifying that the authenticated version of the public key upon which the connection lease was generated matches the public key for the client device.

4. The computing device of claim 2 wherein, prior to the challenge and response, the processor is further configured to validate a signature and date associated with the connection lease, and validate that the public key is valid.

5. The computing device of claim 2 wherein the processor initiates the challenge and validates the signed response after verifying that the authenticated version of the public key upon which the connection lease was generated matches the public key for the client device.

6. The computing device of claim 1 wherein the connection lease includes a hash of the authenticated version of the public key for the client device.

7. The computing device of claim 1 wherein the public/private key pair is generated at the client device using a hardware-backed key store.

8. The computing device of claim 1 wherein the processor is further configured to drop the connection with the client device based on a failure to verify that the authenticated version of the public key upon which the connection lease was generated matches the public key for the client device.

9. A method comprising: receiving a connection request at a virtual delivery appliance from a client device having a public/private encryption key pair associated therewith, the connection request being based upon a connection lease and the public key for the client device, and the connection lease including an authenticated version of the public key for the client device so that the connection lease is specific to the client device; verifying at the virtual delivery appliance that the authenticated version of the public key upon which the connection lease was generated matches the public key for the client device; and authorizing a connection with the client device and providing the client device with access to a virtual computing session via the connection.

10. The method of claim 9 further comprising, prior to authorizing the connection with the client device: initiating a challenge from the virtual delivery appliance to be signed by the client device with the private key associated with the client device; and validating at the virtual delivery appliance the signed response with the public key for the client device.

11. The method of claim 10 wherein initiating and validating comprise initiating the challenge and validating the signed response prior to verifying that the authenticated version of the public key upon which the connection lease was generated matches the public key for the client device.

12. The method of claim 10 wherein initiating and validating comprise initiating the challenge and validating the signed response after verifying that the authenticated version of the public key upon which the connection lease was generated matches the public key for the client device.

13. The method of claim 9 wherein the public key for the client device is registered with a broker; and further comprising validating, at the virtual delivery appliance, that the public key for the client device is registered with the broker prior to verifying that the authenticated version of the public key upon which the connection lease was generated matches the public key for the client device.

14. The method of claim 9 wherein the connection lease includes a hash of the authenticated version of the public key for the client device.

15. A computing system comprising: a server configured to generate a connection lease for a client device, the client device having a public/private encryption key pair associated therewith, and the connection lease including an authenticated version of the public key for the client device so that the connection lease is specific to the client device; and a virtual delivery appliance configured to receive a connection request from the client device based upon the connection lease and the public key for the client device, verify that the authenticated version of the public key upon which the connection lease was generated matches the public key for the client device, authorize a connection with the client device and provide the client device with access to a virtual computing session via the connection.

16. The computing system of claim 15 wherein the virtual delivery appliance is further configured to, prior to authorizing the connection with the client device: initiate a challenge to be signed by the client device with the private key associated with the client device; and validate the signed response with the public key for the client device.

17. The computing system of claim 16 wherein the virtual delivery appliance initiates the challenge and validates the signed response prior to verifying that the authenticated version of the public key upon which the connection lease was generated matches the public key for the client device.

18. The computing system of claim 16 wherein the virtual delivery appliance initiates the challenge and validates the signed response after verifying that the authenticated version of the public key upon which the connection lease was generated matches the public key for the client device.

19. The computing system of claim 15 wherein the server has a public/private key pair associated therewith; wherein generated connection lease is signed with the server private key; wherein the virtual delivery appliance is further configured to, upon receiving the connection lease, verify the connection lease signature and also perform a challenge-response with the client device based upon an authenticated version of the server public key.

20. The computing system of claim 15 wherein the authenticated version of the public key is obtained following authentication from the client device to the server; and wherein the server receives the authenticated version of the public key from the client device and generates the connection lease for the client device responsive thereto.

21. The computing system of claim 15 wherein the connection lease comprises an encrypted payload and an unencrypted manifest; and wherein the authenticated version of the public key is included within the unencrypted manifest.